Concepts: networking comes before application. Moodle is the endpoint (application).
The ip addresses you see in moodle logs shouldn't be 10.x.x.x or 192.168.0.x or 172.16.0.0 – 172.31.255.255 as those are all private IP addresses to be used inside a private network. They are non-routable.
What you do see (if user not using VPN or something to obscure their IP/location) is the public IP address of their gateway (home router).
There could be a group of students at a location ... let's say Student A's house ... that could use different devices ... smartphone/'fablet'/laptop/tabletop ... all connected to the 'house' private network, and all of them (Students A, B, C, D, E) would show to moodle as coming from a single IP address.
When one suspects 'funny business' quite a bit of sluething is required:
a cli query of moodle logs to see an ip
That same IP used in an operating system of the server DNS query (dig -x IP) to see what provider. And to double check that same from your workstation.
Providers of connectivity have their own naming conventions so a dig -x on an IP will give some more info to slueth or contemplate ... or guess. Some, on the other hand, do have 'names' that do give hints/clues.
Example (obscured):
cpe-76-190-19-175.satx.res.rr.com
Network is RoadRunner ... and segment is in San Antonio, Tx.
SA, Tx has a population over 1 Million folks ... don't know how many use Spectrum vs AT&T vs other for their connectivity at home.
Do know, however, that a single person today might own/use multiple devices ... soooooo ..... good luck with very accurate/consistent sluething!
What I have done in past ... created a static trouble shooting web page ... not in moodle ... troubles.html ... and when students reported issues in Moodle, I'd ask them to access that page ... had only an image in it ... 'Muchas Gracias'.
I could then search web server (not moodle DB) access and error logs for 'troubles' and see iP/browser info.
Back then, there exist (believe it or not) Windows Phones and they had issues (no wonder).
Try this with your own smartphone ... access your Moodle server using brower on phone and login. Then via controls on phone change network to local lan or carrier ... which ever is a new connection to network than when you logged on to Moodle.
Then go look at server raw logs and moodle's logs.
Fun and games!
'SoS', Ken